Fortinet FCP - FortiSandbox 5.0 Administrator FCP_FSA_AD-5.0 Exam Dumps: Updated Questions & Answers (May 2026)

From the Deployment and System Settings lesson, the Study Guide states:

" You can submit emails from an upstream MTA server to FortiSandbox using a BCC adapter. FortiSandbox will extract attachment files and URLs in an email body. "

For a BCC adapter to function correctly, two critical prerequisites must be in place:

Option C — The upstream SEG must be configured to BCC emails to a FortiSandbox sub-domain so that email copies are routed to FortiSandbox for analysis

Option D — An MX record must be added to the DNS server for the BCC email sub-domain, so that the sub-domain resolves to the FortiSandbox IP address, allowing the SEG to properly deliver BCC email copies

Option A is incorrect because the BCC adapter handles full email inspection — FortiSandbox itself extracts files and URLs rather than the SEG doing this. Option B is incorrect because an MX record (not just an A record) is the required DNS configuration for email routing.

From the FortiClient EMS Integration lesson, the Study Guide explicitly states:

" It is always a good idea to place the files that are submitted by FortiClient, high on the Job Queue Priority since these are files that end users need immediate access to. In most cases, end users might not be willing to wait for a long time to access these files and placing the FortiClient submitted files high on the Job Queue Priority ensures that these files receive high priority for scanning from FortiSandbox. "

Looking at the exhibit, the Job Priority Configuration shows:

Positions 1-4: On-Demand inputs (highest priority)

Position 5: FortiGate InlineBlock

Positions 6-11: Other sources including FortiWeb, File RPC, Device, FortiClient

As a best practice, FortiClient should rank after On-Demand (positions 1-4) but before FortiGate inputs — since end users need immediate file access, FortiClient submissions should be near the top but On-Demand scanning takes highest precedence.

The exhibit summary says the file was “flagged by the PAIX engine” and describes it as “high-risk behavior.” The lab guide also states for a similar file analysis scenario: “The PAIX engine detected potentially malicious activity… The overall assessment is that there is a high likelihood of malicious activity.” In addition, the FortiGate integration lab explains that “FortiSandbox identified the fsa_dropper.exe file as high risk… because the advanced AI engine was able to detect malicious behaviour… at the static scan phase.” These extracts confirm that the advanced AI / PAIX engine identified the threat , so A is true .

Option D is not supported. The study guide distinguishes high risk from malicious and explains that high risk is a suspicious threat-level rating, not the same as a malicious verdict. It states that FortiSandbox groups results into ratings such as high risk, medium risk, low risk, clean, and malicious , and defines high-risk separately as a serious suspicious rating. Since the exhibit explicitly refers to high-risk behavior , not a malicious verdict, D is false as written . The duplicated B/C options are also not proven by the exhibit text provided.

If your original source intended D to say “The analysis resulted in a high-risk verdict” instead of malicious verdict , then the correct pair would be A and D .

The exhibit labels 10.25.1.50 as the cluster virtual IP address . The Study Guide explains that in HA configuration, “You must configure the HA group name, password, and the virtual IP only on the primary node.” It also says: “You must also configure an external interface for external communication and an IP address that will be used as a virtual IP for the whole cluster. Devices will interact with the cluster using this virtual IP.”

That is why the command for the primary node must point to the cluster virtual IP , not to the individual port1 addresses of the primary, secondary, or upstream firewall. In the exhibit, 10.25.1.30 is the primary node’s own port1 IP, 10.25.1.40 is the secondary node’s port1 IP, and 10.25.1.254 is the network device. The only address that matches the required cluster virtual IP is 10.25.1.50 , so the correct command is hc-settings -si iport1 -a10.25.1.50 .

From the Deployment and System Settings lesson, the Study Guide states:

" Other ports, with the exception of port3, can also be configured as management ports from CLI. "

" You can set additional ports as management port using the CLI command shown on this slide. "

From the Lab Guide (Exercise 4 - Using Inline Scanning) :

" FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443. "

" Enter the following command to enable API access on port2: set api-port port2 "

Ports that are designated as either administration interfaces or API interfaces cannot be selected for 802.3ad aggregate bonding because:

Option A — Port 4 configured as an administration interface is reserved for management traffic and cannot be repurposed for link aggregation

Option C — Port 4 configured as an API interface is dedicated for API communication (port 4443) and is similarly restricted from being used in aggregate bonding configurations

Port 4 in the Lab Guide is specifically referenced as the HA communication and management port, confirming these restrictions apply when special roles are assigned to interfaces.

The uploaded FortiSandbox 5.0 Administrator Study Guide states that each VDOM is handled independently by FortiSandbox, not under the root VDOM’s authorization. It explicitly explains that “each VDOM is treated as a separate input device on FortiSandbox” and that each device must be authorized before FortiSandbox will process its submissions. It further adds that only when auto-authorization is enabled will FortiSandbox automatically authorize VDOMs as files are submitted.

Therefore, the new VDOM does not inherit the root VDOM’s authorized state. Since the question does not say that auto-authorization is enabled, FortiSandbox will not automatically trust or process that new VDOM as if it were already approved. This eliminates A and C. Option D is incorrect because the issue is not that the administrator must manually configure the VDOM on FortiSandbox; the study guide specifically identifies authorization as the required control. For that reason, B is the best answer: the new VDOM must be manually authorized before its submitted files are inspected.

From the Deployment and System Settings lesson, the Study Guide explicitly states:

" The status command shows information about the system, including firmware level, device serial number, disk usage, Windows VM status, states of the boot and data disks, and more. For VM appliances, it will also show the FortiSandbox license status. "

The key phrase is " For VM appliances, it will also show the FortiSandbox license status " — making the status command the correct choice for verifying license validity on a FortiSandbox VM deployment.

While vm-license -l shows installed Windows/Microsoft Office license keys, and vm-status shows guest VM image information, neither directly reports on the FortiSandbox appliance license validity. The status command is the definitive command for checking overall system and license status.

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

" The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file. "

" FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn ' t changed. If the VM status changes, then the VM instance will shut down and will be restored for the next job. "

This precisely matches the requirement — using one VM instance for multiple sequential scan jobs without shutting down between submissions. The other options serve different purposes:

Adaptive Scan dynamically adjusts clone numbers

VM Scan Ratio controls the percentage of jobs scanned in a VM

Parallel VM Scan runs multiple VMs simultaneously for a single job

From the Attack Methodologies lesson, the Study Guide explicitly states:

" During the lateral movement stage, the attacker is trying to compromise and infect other computers in the network. If these computers are protected with FortiClient, FortiClient can send any file that the computer downloads, to FortiSandbox for analysis. "

" FortiDeceptor creates a network of decoys, to lure attackers and monitor their activities on the network. When attackers attack a decoy, an alert is generated. FortiDeceptor engages FortiSandBox to get a verdict on the suspected malware. "

" If you deploy FortiGate as an ISFW firewall, FortiGate can analyze the traffic moving across subnets and send any files to FortiSandbox for analysis to prevent propagation. "

Both FortiDeceptor (Option B) and FortiGate (Option D) are specifically identified as protecting against the lateral movement stage through their FortiSandbox integration.

From the High Availability and Management lesson, the Study Guide states:

" You must configure the HA group name, password, and the virtual IP only on the primary node. After you configure those, you can add the secondary node to the group using the commands shown on this slide. "

The hc-slave command (shown as hc-worker for secondary) requires pointing to the Primary Node ' s HA interface IP , not the cluster virtual IP or the primary node ' s port1.

From the exhibit:

Primary Node port4 (HA interface) = 10.50.1.30

Secondary Node port4 = 10.50.1.40

Primary Node port1 = 10.25.1.30

Cluster Virtual IP = 10.25.1.50

The secondary node must connect to the Primary Node ' s dedicated HA communication port (port4 = 10.50.1.30) to join the cluster, making Option B the correct answer.